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Abstract. We show a new and constructive proof of the following 
language-theoretic result: for every context-free language L, there is a 
bounded context-free language L' (- L which has the same Parikh (com- 
mutative) image as L. Bounded languages, introduced by Ginsburg and 
Spanier, are subsets of regular languages of the form 'W1W2 ■ ■ ■ wl for some 
Wi, . . . £ S* . In particular bounded subsets of context-free languages 
have nice structural and decidability properties. Our proof proceeds in 
two parts. First, using Newton's iterations on the language semiring, we 
construct a context-free subset Ljv of L that can be represented as a se- 
quence of substitutions on a linear language and has the same Parikh im- 
age as L. Second, we inductively construct a Parikh-equivalent bounded 
context-free subset of L]v. 

We show two applications of this result in model checking: to under- 
approximate the reachable state space of multithreaded procedural pro- 
grams and to underapproximate the reachable state space of recursive 
counter programs. The bounded language constructed above provides 
a decidable underapproximation for the original problems. By iterat- 
ing the construction, we get a semi-algorithm for the original problems 
that constructs a sequence of underapproximations such that no two un- 
derapproximations of the sequence can be compared. This provides a 
progress guarantee: every word w G L is in some underapproximation of 
the sequence, and hence, a program bug is guaranteed to be found. In 
particular, we show that verification with bounded languages generalizes 
context-bounded reachability for multithreaded programs. 

1 Introduction 

Many problems in program analysis reduce to undecidable problems about 
context-free languages. For example, checking safety properties of multithreaded 
recursive programs reduces to checking emptiness of the intersection of context- 
free languages [19,4]. Checking reachability for recursive counter programs relies 
on context-free languages to describe valid control flow paths. 

We study underapproximations of these problems, with the intent of building 
tools to find bugs in systems. In particular, we study underapproximations in 
which one or more context-free languages arising in the analysis are replaced by 
their subsets in a way that (PI) the resulting problem after the replacement be- 
comes decidable and (P2) the subset preserves "many" strings from the original 



language. Condition (PI) ensures that we have an algorithmic check for the un- 
derapproximation. Condition (P2) ensures that we are likely to retain behaviors 
that would cause a bug in the original analysis. 

We show in this paper an underapproximation scheme using bounded lan- 
guages [12,11]. A language L is bounded if there exist fc e N and finite words 
wi,W2, ■ ■ ■ ,Wk such that L is a subset of the regular language wl ■ ■ - wl.. In par- 
ticular, context-free bounded languages (hereunder bounded languages for short) 
have stronger properties than general context-free languages: for example, it is 
decidable to check if the intersection of a context-free language and a bounded 
language is non-empty [ ] . For our application to verification, these decidability 
results ensure condition (PI) above. 

The key to condition (P2) is the following Parikh-boundedness property: for 
every context-free language L, there is a bounded language L' C L such that 
the Parikh images of L and V coincide. (The Parikh image of a word w maps 
each symbol of the alphabet to the number of times it appears in w, the Parikh 
image of a language is the set of Parikh images of all words in the language.) A 
language L' meeting the above conditions is called a Parikh- equivalent bounded 
subset of L. Intuitively, L' preserves "many" behaviors as for every string in L, 
there is a permutation of its symbols that matches a string in L' . 

The Parikh-boundedness property was first proved in [10,2], however, the 
chain of reasoning used in these papers made it difficult to see how to explicitly 
construct the Parikh-equivalent bounded subset. Our paper gives a direct and 
constructive proof of the theorem. We identify three contributions in this paper. 
Explicit construction of Parikh-equivalent bounded subsets. Our con- 
structive proof falls into two parts. First, using Newton's iteration [ ] on the 
semiring of languages, we construct, for a given context-free language L, a fi- 
nite sequence of linear substitutions which denotes a Parikh-equivalent (but not 
necessarily bounded) subset of L. (A linear substitution maps a symbol to a 
language defined by a linear grammar, that is, a context-free grammar where 
each rule has at most one non-terminal on the right-hand side.) The Parikh 
equivalence follows from a convergence property of Newton's iteration. 

Second, we provide a direct constructive proof that takes as input such a 
sequence of linear substitutions, and constructs by induction a Parikh-equivalent 
bounded subset of the language denoted by the sequence. 

Reachability analysis of multithreaded programs with procedures. Us- 
ing the above construction, we obtain a semi-algorithm for reachability analysis 
of multithreaded programs with the intent of finding bugs. To check if configu- 
ration (ci,C2) of a recursive 2-threaded program is reachable, we construct the 
context-free languages — L{ci) and — ^(^2) respectively given by the ex- 
ecution paths whose last configurations are ci and C2 , and check if either L'l fl L2 
or Li n L'2 is non-empty, where L[ = D wl ■ ■ ■ and L'^ = L'^ Dvl ■ ■ ■ v* 
are two Parikh-equivalent bounded subsets of Lf and L^i respectively. If either 
intersection is non-empty, we have found a witness trace. Otherwise, we con- 
struct L] = LiHwl ■ ■ -wl and L2 = ^2 ^1 ' ' ' i^i order to exclude, from the 
subsequent analyses, the execution paths we already inspected. We continue by 



rerunning the above analysis on L\ and L\. If (ci, C2) is reachable, the iteration 
is guaranteed to terminate; if not, it could potentially run forever. Moreover, we 
show our technique subsumes and generalizes context-bounded reachability [In]. 
Reachability analysis of programs with counters and procedures. We 
also show how to underapproximate the set of reachable states of a procedural 
program that manipulates a finite set of counters. This program is given as a 
counter automaton A (see [17] for a detailed definition) together with a context- 
free language L over the transitions of A. Our goal is to compute the states of 
A that are reachable using a sequence of transitions in L. 

A possibly non terminating algorithm to compute the reachable states of A 
through executions in L is to (1) find a Parikh-equivalent bounded subset L' of 
L; (2) compute the states that are reachable using a sequence of transitions in 
L' (as explained in [17], this set is computable if (i) some restrictions on the 
transitions of A ensures the set is Presburger definable and (m) L' is bounded, 
i.e. L' C wl ■ ■ ■ wl); and (3) rerun the analysis using for L Ci ■ ■ ■ so that 
runs already inspected are omitted in every subsequent analyses. Again, every 
path in L is eventually covered in the iteration. 

Related Work. Bounded languages have been recently proposed by Kahlon for 
tractable reachability analysis of multithreaded programs [ i -i]. His observation 
is that in many practical instances of multithreaded reachability, the languages 
are actually bounded. If this is true, his algorithm checks the emptiness of the 
intersection (using the algorithm in [ ]). In contrast, our results are applicable 
even if the boundedness property does not hold. 

For multithreaded reachability, context-bounded reachability [1 8,20] is a pop- 
ular underapproximation technique which tackles the undecidability by limiting 
the search to those runs where the active thread changes at most k times. Our 
algorithm using bounded languages subsumes context-bounded reachability, and 
can capture unboundedly many synchronizations in one analysis. We leave the 
empirical evaluation of our algorithms for future work. 

2 Preliminaries 

An alphabet is a finite non-empty set of symbols. We use the letter S to denote 
some alphabet. We assume the reader is familiar with the basics of language 
theory (see [13]). The concatenation L-L' of two languages L, L' C U* is defined 
using word concatenation a,s L ■ L' ~ {I ■ I' \ I E L A I' G L'}. 

An elementary bounded language over is a language of the form • • • 
for some wi, . . . ,Wk G ■ 

Vectors. For p G N, we write and N'' for the set of p-dim vectors (or 
simply vectors) of integers and naturals, respectively. We write for the vec- 
tor (0, . . . , 0) and e^ the vector (zi, . . . , Zp) G such that Zj = 1 ii j = i 
and Zj = otherwise. Addition on p-dim vectors is the componentwise ex- 
tension of its scalar counterpart, that is, given (xi, . . . ,Xp), (yi, . . . ,yp) G IP 
{xx,...,Xp)^ (yi, . . . ,yp) = (xi -I- yi, . . . -I- yp). Given A € N and x € If, we 
write Ace as the A-times sum x -\- ■ ■ ■ + x. 



Parikh Image. Give S a fixed linear order: S = {oi, . . . , Up}. The Parikh iraage 
of a symbol Ui E S, written 11 ^{ai), is e^. The Parikh image is extended to words 
of i:* as follows: Usie) = and n^iu-v) = ns{u)+ns{v). Finally, the Parikh 
image of a language on S* is the set of Parikh images of its words. We also define, 
using vector addition, the operation + on sets of Parikh vectors as follows: given 
Z, Z' CW,let Z + Z' = {z + z' \ z E Z A z' E Z'). Thus, Hs maps 2^' to 
We also define the inverse of the Parikh image 

7J-1; 2^" ^ 2^* as follows: given 
a subset M of N^, n^^iM) is the set {y e S* \ 3m £ M : m ^ ns{y)}. When 
it is clear from the context we generally omit the subscript in Us and . 

The following lemma gives the properties of 11 and 77~^ we need in the 
sequel. 

Lemma 1. For every M € 2^*^ we have 11 o n^^{M) — M. 
Let (j) = o n , for every X,Y C E* we have: 

additivity of 77 n{X U F) = n{X) U 77(y),- 
monotonicity oi cf) X CY implies (j>{X) C (j){Y); 
extensivity of (j) X C (t){X); 
idempotency of o — (piX); 

structure-semipreservation of (p ' (PO^) Q 4'{X ' 

preservation of 77 77(X • Y) = n{X) + 77(y). 



Proof. For the first statement we first observe that 77 is a surjective function, 
for each vector of there is a word that is mapped to that vector. Next, 

77 o n-\M) = n{{y I 3m e M: m = n{y)}) def. of 77"^ 

= {n{y) I 3m e A7 : m = 7T(y)} def. of 7J 

— M surjectivity of 7J 

For the additivity, the monotonicity, the extensivity and the idempotency prop- 
erties, we simply show the equivalence given below. Hence the properties imme- 
diately follows by property of Galois connection (we refer the reader to [7] for 
detailed proofs). We show that for every L € 2^' , M € 2^^ we have : 77(L) C M 

iff L c n-^{M). 

L c n-\M) 

iff L C {y I 3m e M : m = 7T(y)} def. of 77"^ 

iff ye e L3me M: m = n{i) 

iff yh e n{L) 3me M: m = h def. of 7T 

iff 77(7.) C M 



For structure semipreservation, we prove that (j){x) ■ <p{y) C (p[x ■ y) for x,y & E* 
as follows: 

(j){x) ■ (j){y) = n-^ o n{x) ■ n-^ o n{y) 

= {x' I n{x') = n{x)} ■ {y' I n{y') = n{y)} def. of 77-1 

= {x' ■ y' I n{x') = nix) A n{y') = n{y)} 

C {x' ■ y' I iT(x') + n{y') = 77(x) + i7(y)} 

= {x' -y' \n{x' ■y')=n(x-yy\ def. of 17 

= iJ-i o n{x ■ y) 

= ■ y) 

The result generalizes to languages in a natural way. Finally, the preservation of 
n is proved as follows: 

n{X ■ Y) = {n{w) \w(^X-Y} def. of i7 

= {n{x ■y)\x€X ^y&Y} def. of • 

= {n{x) + n{y) \ x&X hy&Y} def. of iT 

= {a + 6 I a e n{X) Ab€ n{y)} 
= n{X) + n{Y) def. of + 

□ 

Context-free Languages. A context-free grammar G is a tuple {X, S, S) where 

X is a, finite non-empty set of variables (non-terminal letters) , Z" is an alphabet of 
terminal letters and S C X x (SUX)* a finite set of productions (the production 
{X, w) may also be noted X ^ w). Given two strings u,v G {S U X)* we define 
the relation u v, if there exists a production (X, w) G S and some words 
y,z £ [EU Xy such that u = yXz and v = ywz. We use =>* for the reflexive 
transitive closure of =>. A word w €: S* is recognized by the grammar G from 
the state X d X ii X ^* w. Given X E X, the language Lx{G) is given by 
{w & S* \ X =>* w}. A language L is context-free (written CFL) if there exists 
a context-free grammar G = {X, S, S) and an initial variable X G X such that 
is i = Lx{G). A linear grammar G is a context-free grammar where each 
production is in A" x E*{X U {e})i7*. A language L is linear if L = Lx{G) for 
some linear grammar G and initial variable X of G. A CFL L is bounded if it is 
a subset of some elementary bounded language. 
Proof Plan. The main result of the paper is the following. 

Theorem 1. For every CFL L, there is an effectively computable CFL V such 
that (i) L' C L, (ii) n{L) = n{L'), and [Hi) L' is bounded. 

We actually solve the following related problem in our proof. 



Problem 1. Given a CFL L, compute an elementary bounded language B such 
that n{Lr\B) = n{L). 



If we can compute such a B, then we can compute the CFL L' — B C\ L 
which satisfies conditions (z) to {iii) of the Th. 1. Thus, solving Pb. 1 proves the 
theorem constructively. 

We solve Pb. 1 for a language L as follows: (1) we find an L' such that 
L' C L, n{L') = n{L), and L' has a "simple" structure (Sect. 3) and (2) then 
show how to find an elementary bounded B with iT(L' B) = n{L'), assuming 
this structure (Sect. 4). Observe that ii L' C L and n{L) — n{L'), then for every 
elementary bounded B, we have 7T(L' n B) ^ n{L') implies i7(L D B) ^ n{L) 
as well. So the solution B for L' in step (2) is a solution for L as well. Section 5 
provides applications of the result for program analysis problems. 

3 A Parikh-Equivalent Representation 

Our proof to compute the above L' relies on a fixpoint characterization of CFLs 
and their Parikh image. Accordingly, we introduce the necessary mathematical 
notions to define and study properties of those fixpoints. 

Semiring. A semiring 5 is a tuple {S, ®, 0, 0, 1), where 5 is a set with 0, 1 € S', 
(5, CD, 0) is a commutative monoid with neutral element 0, (S", 0, 1) is a monoid 
with neutral element 1, is an annihilator w.r.t. 0, i.e. O0a = a0O = O for 
all a e 5, and distributes over ©, i.e. a Q {b ® c) = (a 6) © (a c), and 
(a © 6) c = (a c) © (6 c) . We call © the combine operation and the 
extend operation. The natural order relation C on a semiring S is defined by 
a Q b <^ 3d S : a (B d = b. The semiring S is naturally ordered if C is a partial 
order on S. The semiring S is commutative ii a Q b = b Q a for all a,b £ S', 
idempotent if o© a = a for all a e 5, complete if it is naturally ordered and C is 
such that w-chains ag E Oi C • • • C a„ C • • • have least upper bounds. Finally, 
the semiring iS is uj-continuous if it is naturally ordered, complete and for all 
sequences (ai)igN with G S, sup {®"^o | rt € N} = ® a^. We define two 
semirings we shall use subsequently. 

Language Semiring. Let C = (2^ ,U,-,0,{£}) denote the idempotent oj- 
continuous semiring of languages. The natural order on L is given by set 
inclusion (viz. C). 



Parikh Semiring. The tuple V = ^2^*", U, +, 0, {0}y is the idempotent uj- 
continuous commutative semiring of Parikh vectors. The natural order is 
again given by C. 

Valuation, partial order, linear form, monomial and polynomial 
(transformation). A valuation v is & mapping X ^ S. We denote by S"^ 
the set of all valuations and by the valuation which maps each variable to 0. 
The operations ©, are naturally extended to valuations. The partial order C 
on S can be lifted to a partial order on valuations, to this end we stack a point 
above C (viz. C) to denote the pointwise inclusion, given hy v \— v' if and only 
if v{X) C v'{X) for every X 

A linear form is a mapping I: S"^ — >■ S satisfying l(v © v') — l{v) © l{v') for 




every v, v' £ 5*^ and 1(0) = 0. 

A monomial is a mapping — > S described by a finite expression m = 
ai 0Xi 002 . . . Cfc ©Xfc0afe_|_i where fc > 0, ai, . . . , aj^^i S S and Xi, . . . X^. G X 
such that m{v) = ai 02 ... v{Xk) afc+i for G 5"^. The empty 

monomial is given by an empty expression coincides with 1. 
A polynomial is a finite combination of monomials : / = mi • • • © ruk where 
fc > and mi, . . . , mfc are monomials. The set of polynomials w.r.t. S and X will 
be denoted by 5 [A"]. The empty polynomial is given by an empty combination 
of monomials and coincides with 0. 

Finally, a polynomial transformation F is, & mapping 5*^ — ?■ 5*^ described by 
the set {Fx G S[X] \ X £ X} of polynomials: hence, for every valuation v G S"^ , 
F{v) is a valuation that assigns each variable X £ X to Fx{v). 
Differential. For every X £ X, let dX denote the linear form defined by 
dX{v) = v{X) for every v £ 5"^: dX is the dual variable associated with the 
variable X. Let dX denote the set {dX \ X £ X} of dual variables. 

Let / £ S[X] be a polynomial and let X e A" be a variable. The differential 
w.r.t. X of / is the mapping Dxf- — >■ — >■ S that assigns to every 
valuation v the linear form Dxf\v defined by induction as follows: 

if / e 5 or / e A" \ {X} 

dX if / = ^ 

Dxg\vQh{v)®g{v)QDxh\^ ii f = g Q h 

Dx9\v®Dxh\^ iif^g(S)h . 

Then, the differential of / is defined by 

^/ - Dxf ■ 

xex 

Consequently, the linear form Df\^ is a polynomial of the following form: 

(oi dXi a'l) © . . . © (ofc © dXk © 

where each 0^,0^ £ S and Xi £ X. We extend the definition of differential on 
polynomial transformation. Hence, DF : 5'^ — ?> S"^ — ^ is defined for every 
v,w £ iS'^ and every variable X as follows: 

{DFUw))(X) = DFxUw) . 

Least Fixpoint. Recall that a mapping / : 5 — >■ 5 is monotone if a C 6 im- 
plies /(a) C /(&), and continuous if for any infinite chain 00,01,02,... we 
have sup{/(ai)} = /(sup{oi}). The definition can be extended to mappings 
F : S"^ — >■ from valuations to valuations in the obvious way (component- 
wise). Then we may formulate the following proposition (cf. [15]). 

Proposition 1. Let F be a polynomial transformation. The mapping induced by 
F is monotone and continuous. Hence, by Kleene 's theorem, F has a unique least 

fixpoint iiF. Further, /iF is the supremum (w.r.t. of the Kleene' s iteration 
sequence given by rfo = F{0), and r/j+i = F{rji). 




Fixpoints of polynomial transformations relates to CFLs as follows. Given 
a grammar G = {X, S, S), let L{G) be the valuation which maps each variable 
X G X to the language Lx{G). We first characterize the valuation L{G) as the 
least fixpoint of a polynomial transformation F defined as follows: each Fx of 
F is given by the combination of a's for {X, a) (z 5 where a is interpreted as a 
monomial on the semiring C. From [ ] we know that L{G) = fiF. 

Example 1. Let G = ({Xq, Xi}, {a, &}, 5) where 5 = {{Xq aXi\a), {Xi 
XoblaXibXo)}. It defines the polynomial transformation F on C'^ such that 
Fxo = a ■ XiU a and Fx^ = Xq ■ bU a ■ Xi ■ b ■ Xq, and L{G) is the least fixpoint 
of F in the language semiring. □ 

We now recall the iteration sequence of [ , ] whose limit is the least fixpoint 
of F. In some cases, the iteration sequence converges after a finite number of 
iterates while the Kleene iteration sequence does not. 

Newton's Iteration Sequence. Given a polynomial transformation F on a 
w-continuous semiring S, Newton's iteration sequence is given by the following 
sequence: 

Mo = F{0) and = DF\*^^ 

the limit of which coincides with ^F (see [9,8] for further details). 

3.1 Relating the Semirings 

We naturally extend the definition of the Parikh image to a valuation v e C"^ as 
the valuation of V"^ defined for each variable X by: n{v){X) = n{v{X)). The 
following lemma relates polynomial transformations on C and V. 

Lemma 2. Let fc G ^[X], that is a polynomial over the semiring C and vari- 
ables X. Define f-p = n o fc ° , we have f-p G V[X]. 

Proof. By induction on the structure of fc- The polynomial fc is given by 
mi U • • • U mi. Hence, 

n o fco TT^i = n o {miU ■ ■ -Ume) o iJ-i 

= 77 o mi o 77"^ U • • • U 77 o m£ o 77"^ 

where each m.^ is of the form ai ■ Xi • 02 . . . • Xk ■ Ok+i with oi , . . . , Ok+i C S* , 
Xi, . . . , Xk G X . Let m be a monomial, we have: 

7J o m o 77^^ = 77 o m • Xi ■ 02 . . . ■ X^ ■ a^+i ° 7T^^ 

= 77(ai) + Xi+ 77(02) • • ■ n{ak) + Xk + n{ak+i) id. of 77 o 77"i, preser. of 77 

□ 

We now prove a commutativity results on polynomials and the Parikh map- 
ping. 



Lemma 3. Let fc & ^l^i^], for every valuation v G we have: 

n{fdv)) = Mn{v)) . 



Proof. First, the definition of f-p shows that for every v € 

nof^{v) = fvon{v) 

iff n o fc{v) = n o ij-i o n{v) 

only if o n o f^(v) = H'^ o 7J o o iJ-i o n{v) appl. of iT"^ 

Moreover, 

TJ-i o iJ o fj^{v) = o i7 o /£ o iJ-i o J7(t,) 
only if 77 o 77"^ o 77 o f^v) = n o n'^ ° o o H'^ o 77(t;) 
only if n o f^{v) = n o f^o iJ-i o n{v) 

mnof^{v) = f-pon{v) 

Hence, 

n o fj.(v) = f-p o n{v) iff n-^ o n o f^(v) = n-^ ° ° /r ° n-^ o n{v) 

Let (j) = 77"^ o 77, we will thus show that for every v G 

(t> ° fc{v) = 4>° fc° (l){v) 

The inclusion (j> ° fc{v) (j) ° fc ° 4^{v) is clear since v C (p{v), every function 
occuring in the above expression is monotone and the functional composition 
preserves monotonicity. For the reverse inclusion, we first show that for every 
w C (f>[v) we have fc{w) C </> o fciv). That is Va; G fciw) : x £ <j) o fc{v). fc € 
£[X] shows that x G m{w) for some monomial m = ai • Xi • 02 . . . flfe • Xk ■ flfe+ij 
that is a; e ai • w{Xi) • 02 . . . afe • w{Xk) ■ afe+i- We have, 

° fc{v) 2 ?!>(ai • ^(Xi) • a2 . . . ttfe • ■u(Xfe) • a^+i) 

D 4>{ai) ■ (j){v{Xi)) ■ <f){a2) . ■ ■ (t){ak) ■ (j)(v{Xk)) ■ ^{ak+i) 
3 ai ■ (f){v{Xi)) • 02 . . . fflfe • (j){v{Xk)) ■ afc+i 
2 ai ■ w{Xi) • a2 . . . aft • w{Xk) ■ ak+i 
9 X 

The following reasoning concludes the proof: 

fc ° 4' ° fc{v) from above with w = (j){v) 

only ii (j) o fc ° <t){v) C ^ o o fc{v) monotonicity of </> 

iff (f) ° fc ° (l>{v) C (p o fc{v) idempotency of (f) 

□ 



appl. of 77 
identity of 77 o 77"^ 
def. of f-p 



struct, semipreserv. 
extensivity of (f) 
w C (l){v) 
def. of X 



Here follows a commutativity result between the differential and the Parikh 
image. 

Lemma 4. For every fc G every valuation v,w £ , every X £ X we 

have: 

niDxfcUw)) = Dxfv\ni.){n{w)) . 



Proof. First it is important to note that Lemma 2 shows that f-p and fc are of 
the same form. Then the proof falls into four parts according to the definition 
of the differential w.r.t. X. 

fc e 2^' or /£ e A" \ {X}. In this case, we find that DxfcUiw) = 0, 
hence that n{Dx fclviw)) = 0. Since f-p is of the above form, we find that 
Dxfv\nMin{w))^(l}. 

fc = X. So fr - X. 

n{DxX\^{w)) = n{dX{w)) def. of diff 

= n{w{X)) def. of dX 

= n{w){X) def. of 77 

= dX{n{w)) def. ofdX 

= DxX\n(^){n{w)) def. of diff 

fc — 9c ■ h-c So f-p is of the form gp + h-p . The induction hypothesis shows the 
rest. 

fc = Uie/ fi this case is treated similarly. □ 

This result generalizes to the complete differential : 

n{DfcUw)) = Dfp>\n{v){n{w)) . 

We note that the previous results also generalizes to polynomial transforma- 
tion in a natural way. In the next subsection, thanks to the previous results, 
we show that Newton's iteration sequence on the language semiring reaches a 
stable Parikh image after a finite number of steps. This result is crucial in order 
to achieve the goal of this section: compute a sublanguage L' of L such that 

n{L) = n{L'). 



3.2 Convergence of Newton's Iteration 

Given a polynomial transformation F ^ we now characterize the relationship be- 
tween the least fixpoints ^lF taken over the language and the Parikh semiring, 
respectively. Either fixpoint is given by the limit of a sequence of iterates which 
is defined by Newton's iteration scheme [8,9]. Our characterization operates at 
the level of those iterates: we inductively relate the iterates of each iteration 
sequence (over the Parikh and language semirings). We use Newton's iteration 



instead of the usual Kleene's iteration sequence because Newton's iteration is 
guaranteed to converge on the Parikh semiring in a finite number of steps, a 
property that we shall exploit. Kleene's iteration sequence, on the other hand, 
may not converge. Lemma. 5 relates the iterates for fiFc and /ii^-p using the 
Parikh image mapping. 



Lemma 5. Let (t'i)igN o-iT'd ('*i)iGN be Newton's iteration sequences associated 
with Fc and F-p, respectively. For every i G N, we have n(ui) = Ki. 

Proof, base case, [i = 0) This case is trivially solved using part (2) of Lem. 2. 
inductive case. (« + 1) 

n{u,+^)^n{DFc\lSFdi^i))) 

= n{\jDFc\i^{Fc{u,))) def. of* 

= U n{DFc\U {Fc{j^i))) additivity of 7T 

= U n{DFc\^^{DFc\i~\Fc{ui)))) funct. comp. 

= U DFr\n(u^){n[DFc\i-\Fc{v,)))) Lem. 4 

= y DFr\'n^^^.^{n{Fc{v,))) j - Ix Lem. 4 

^{jDFr>Y^^{Fr>{K,)) ind. hyp. 

= DF-p\*^^{FAKi)) 

□ 

In [9] , the authors show that Newton's iterates converges after a finite number 
of steps when defined over a commutative w-continuous semiring. This shows, in 
our setting, that {Ki)i^^ stabilizes after a finite number of steps. 



Lemma 6. Let (/«i)igN be Newton's iteration sequence associated to F-p and let 
n be the number of variables in X . For every k > n, we have K]^ — n{fiFc). 
Hence, for every k>n, lHu].) = LI^fiF^). 



Proof. 



Ki = n{ui) 



for each i e N by Lem. 5 



=^ y = y n{u.,) 



^ /zFp = y n{vi) 



w-continuity of V 



additivity of 77 



w-continuity of C 
for every k > n hy Th. 6 of [ i] 



Transitivity of the equahty shows the remaining result. 



□ 



We know Newton's iteration sequence («>'i)igN: whose hmit is may not 

converge after a finite number of iterations. However, using Lem. 6, we know 
that the Parikh image of the iterates stabiUzes after a finite number of steps. 
Precisely, if n is the number of variables in X, then the language given by Un is 
such that nlvn) = n{L{G)). Moreover because (t'i)igN is an ascending chain, 
for each variable X ^ X, we have that i'n{X) is a sublanguage of Lx{G) such 
that 7T(m„(X)) = n{Lx{G)). 

3.3 Representation of Iterates 

We now show that Newton's iterates can be effectively represented as a combi- 
nation of linear grammars and homomorphisms. 

A substitution a from alphabet Si to alphabet S2 is a function which maps 
every word over Si to a set of words of S2 such that cr(e) = {e} and a{u ■ v) = 
<j{u) ■ (t{v). a homomorphism h is a substitution such that for each word u, h{u) 
is a singleton. We define the substitution (J[a/b] ■ ^1 U {a} Si U {b} which 
maps a to 6 and leaves all other symbols unchanged. 
We show below that the iterates {iyk)k<n have a "nice" representation. 

Let us leave for a moment Newton's iteration sequence and turn to our initial 
problem as stated in Pb. f . Let i be a context-free language, our goal is to com- 
pute a sublanguage L' such that n{L) = n{L') (then we solve Pb. 1 on instance 
L' instead of L because it is equivalent). Below we give an effective procedure to 
compute such a L' based on the previously defined iteration sequences and the 
convergence results. 

Given a grammar G = {X , S, 6), let L(G) be the valuation which maps each 
variable X G X to the language Lx{G). We first characterize the valuation L{G) 
as the least fixpoint of a polynomial transformation F which is defined using G 
as follows: each Fx of F is given by the combination of a's for {X, a) G S where 
a is now interpreted as a monomial on the semiring C. 



Example 2. Let G — {{Xq, Xi}, {a, 6}, 6) be the context-free grammar with the 
production: 

Xq — > aXi I a 

Xi Xob I aXibXo 

It defines the following polynomial transformation on where Fxg — clXi U a 
and Fx I ^ XobU aXibX^. 

It is well known that L{G) = fiF (see for instance [ ]). To evaluate fsF one 
can evaluate Newton's iteration sequence for F . However, a transfinite 

number of iterates may be needed before reaching ^lF . We now observe that, by 
the result of Lem. 6, if we consider the iteration sequence {vk)k<n up to iterate 
n where n equals to the number of variables in X then the language given by fn 
is such that i7(i/„) — n{L(G)). Moreover because (i'i)igN is an ascending chain 
we find that: for each variable € X , i>'„(Xo) is a sublanguage of Lxg{G) such 
that 7TK(Xo)) = 77(Lxo(G)). 

We now explain how to turn this theoretical result into an effective procedure. 
Our first step is to define an effective representation for the iterates {vk)k<n- Our 
definition is based on the one that was informally introduced in Example 3.1, 
part (2) of [ ]. To this end, we start by defining how to represent the differen- 
tial DF\*^{F{v)) used in the definition of Newton's iteration sequence as the 
language generated by a linear grammar. 

We define v to be the valuation which maps each variable X ^ X to vx 
where vx is a new symbol w.r.t. S. We first observe that DF\v is a polyno- 
mial transformation on the set of dual variables dX such that the linear form 
associated to X is a polynomial of the form: 

(ai • dXi • a'l) U • • • U (afc • dXk ■ a'J 

where each a^, a- G (Z" U {vy \ Y e X})* and Xi G X. Moreover, Fx is a sum 
of monomials mi, ... , me. Hence, we define the linear grammar G — {X, S U 
{vx I X e X},5). For the variable X, the set of productions 6 is: 

X aiXia[ I ... I QkXka'^ 
X mi{v) \ . . . \ mi{v) 

We are able to prove that: 

Lemma 7. Let v be the valuation which maps each variable X €z X to vx ■ 

L{G) ^ DF\l{F{v)) . 



Proof. We show by induction the following equivalence. Let X € X , w £ S \J 
{vY\Y€Xy: 

X ^'^+1 u; iff to e DF\l{F{v)){X) . 



Base case, {k = 0) In this case, the following equivalence has to be estab- 
lished: 

iff w e Lx{X mi{v) I • • • I mi{v)) 

i& w G mi{v) U ■ ■ ■ U me{v) the monomials for Fx{v) 

iff w € Fx{v) 
iff w e F{v){X) 

Inductive case, (fc + 1) 

w € DF\t+HFiv))iX) 

iff w e DF\^{DF\':^{F{v))){X) funct. comp. 

iE w e DFxUDF\^^{F{v))) 

iff w e (ai • dXi • a'l) U . . . U (afc • dXfc • a'^.){DF\'^{F{v))) def. of diff. 

iff3i: we {ai ■ dX, ■ a'i){DF\''^{F{v))) 

m3i3w' e w = ■ w' ■ a', 

iff 3i 3w' : X -> ajXja ■ G ^ A =>^+i w' A Oiw'a ■ = iz; 

iff X ^'=+2 «; 

□ 

Example 3. (cont'd from the previous example) The differential of F is given 
by: 

adXi 

AXq b\JadXi bv{Xa) U av{Xi) bdXo 



DFL 



The grammar G is given by {{Xq, Xi}, {a,b,vxo,vxi},S) where S is such 
that: 

Xq aXi I avxi \ a 

Xi^ Xob\ aXibvxo \ avx^bXa \vxob\ avx^bvxo ■ 

A;-fold composition. We effectively compute and represent each iterate as the 
valuation which maps each variable X to the language generated by a fc-fold 
composition of a substitution. Since the substitution maps each symbol onto 
a language which is linear, it is effectively represented and manipulated as a 
linear grammar. To formally define the representation we need to introduce the 
following definitions. 

Let G — {X, Sii {vx I X e X}, S) be a linear grammar and let k gN, define 
v'^ to be the set of symbols {u^ | X e Af}. Given a language L on alphabet 
EU{vx I X e X}, we define L[v^] to be cr^^^/^k^^^^^iL). 

For k G {1, . . . , n}, we define cxfe : S U — > E U as the substitution 
which maps each Vx onto Lx{G)[v'^^] and leaves S unchanged. For fc = the 



substitution (Tq maps each on F{0)(X) and leaves S unchanged. Let k,£ be 
such that Q<k<£<nwe define al to he ak ° ■ ■ ■ ° ere- Hence, ctq is such that: 

{suv'^y ^ {s u v'^^^^y ■ ■ ■ {s u v^^y ^ {s^v%y ^ s*. 

Finally, the k-fold composition of a linear grammar G and initial variable X 
is given by tTg(w^). Lemma 8 relates fc-fold compositions with (i/fe)^^^- 

Lemma 8. There exists an effectively computable linear grammar G such that 
for every k >0, every X £ X we have i/k{X) — (j^{v'^). 

Proof. By induction on k. 

Base case, {k = 0) Definition of the iteration sequence shows that Vo{X) = 
F{0){X) which in turn equals ao{v'^) by definition. 

Inductive case, (fc + 1) First, let us define (7^^. to be the substitution which 
maps vx onto UkiX). Hence we have 

Uk+i = DF\l^iF{uk)) def. of/^fe+i 

= (Ti,^, (L(G)) Lem. 7, def. of a^^ 

The above definition shows that cr^^ {vx ) = fkiX), hence that a,^^ {vx ) — <Jq {vx ) 
by induction hypothesis. Hence 

i^k+i{X) = a^,{Lx{G)) 

= ° fT[„. def. of a'^+i 
= 4 o (7'=+i(w^+i) by above 

□ 

Lem. 8 completes our goal to define a procedure to effectively compute and 
represent the iterates {i^k)keN- This sequence is of interest since, given a CFL L 
and Un the n-th iterate (where n equals the number of variables in the grammar 
of L so that n{un) = n{L)), if B is a solution to Pb. 1 for the instance !/„, B 
is also a solution to Pb. 1 for L. 

Let us conclude this section on a complexity note. Below we show that the 
linear grammar G given in Lem. 8 is computable in polynomial time in the size 
of F which is to be defined. To start with we define the size of a monomial which 
is intuitively the length of the "string" that defines the monomial. Formally, let 
m be a monomial its size denoted, sizeof{m), is given by if m is the empty 
monomial; 1 if m € 2^ or m e A" U dX and by sizeof{mi) + sizeof{m2) if 
m = TOi-m2. The above definition naturally extends to polynomials by summing 
the sizes of the monomials. The empty polynomial has size zero. 

In what follows we show that the derivative of a monomial as a polynomial 
of some form. 

Lemma 9. Let m = bi ■ ■ ■ bk be a monomial where each bi G 2^ \JX , let X G X 
and V € C"^ . We have Dxm\v coincide with the polynomial given by: 



1. apply the inductive definition of a derivative on m which is given by 
Dxm\i> = Dx{bi ■ ■ ■ -f (6fe)U (61 • • • fofe-i) - a where a ^ dX ifbk = X 
and otherwise. Above we abusively wrote v{hk) which in fact denotes v{b]^) 
if bk (z X and bk otherwise. 

2. turn the result into a polynomial, that is a finite combination of monomials, 
by distributing ■ over U (in the inductive part of point (1)). 

In the rest of this section, we identify Dx^\v with the polynomial of Lem. 9. 

Lemma 10. Let ni = bi---bk, and Dx'nn\v = Uiefi have 
sizeof {mi) < k and I < k. 

Proof, k = 1. Dxm\v = "I f ' which concludes the case. 

I else 

k > 1. Induction hypothesis shows that Dx{bi ■ ■ ■ bk-i)\-v = Uje{i J}^'j 
where sizeof (m'^) < k — I and J < fc — 1. Hence by Lem. 9, the distributiv- 
ity of • over U, the size of v{bk) bounded by 1 show that sizeof [mi) < k and 
I = J +1 <k. □ 

Corollary 1. The size of Dx{bi ■ ■ ■ is bounded by k^ (where k is the size 
of the monomial) . 

Let us extend this reasoning to polynomials and polynomial transforma- 
tions. Let / = Uig{i /} ^i- The definition of differential shows that Dxf\v = 
Ui<i</ -^x^^iU where each Dx'mi\v is a polynomial as shown by Lem. 9. Let 
n = sizeof {f), we have that sizeof {Dxf\v) is bounded by n^. This result follows 
from Coro. 1 and the fact that I < n. 

Let us now extend our result to the differential in each variable. The definition 
of derivative shows that Df\j, — UxeA' ^xf\v the definition of which is given 
above. Let n = maxd^"], sizeof {f)), we find that sizeof {Df\j,) is bounded by n^. 

Finally we extend the result to polynomial transformation using the equal- 
ity (DF\.^){X) = DFx\v Let us now characterize the time complexity of the 
algorithm that computes for DF\t,. 

Corollary 2. Let F and v be respectively a polynomial transformation and a 
valuation over X . Define S = {v{X)} ^^p^\j{a e C \ 3X € X: a occurrs in Fx}. 
The size of S is given by the sum of the size of each of its member. The size of 
a G 2^ is given by the sum of the length of each w E a. If S is of finite size 
then DF\v is computable in time polynomial in the size of each Fx, X and the 
size of S. 

Remark that we could generalize and drop the finiteness requirement for S. 
For example, regular languages or context-free languages would be admissible 
candidates for each element of S because they come with a finite representa- 
tion and decision procedure for the tests/operations we need to compute the 
differential. 

We showed above how to compute G from DF\„ and F. So we conclude that 
G is computable in time polynomial in the size of each Fx , X and the size of S. 



4 Constructing a Parikh Equivalent Bounded Subset 



We now show how, given a fc-fold composition L' , to compute an elementary 
bounded language B such that 7T(L' n i?) = n{B), that is we give an effective 
procedure to solve Pb. 1 for the instance L' . This will complete the solution to 
Pb. 1, hence the proof of Th. 1. In this section, we give an effective construction 
of elementary bounded languages that solve Pb. 1 first for regular languages, 
then for linear languages, and finally for a linear substitution. We start with 
Lem. 11 the proof of which is given in [16]. First we need to introduce the 
notion of scmilinear sets. A set A C N" is a linear set if there exist c G and 
Pi, - ■ ■ iPk G N" such that ^ = |c + X^iLi ^iPi I ^ -^j- c is called the constant 
of A and pi, . . . ,pk the periods of A. A semilinear set S" is a finite union of 
linear sets: S = U^=i where each Aj is a linear set. Parikh's theorem (cf. [11]) 
shows that the Parikh image of every CFL is a semilinear set that is effectively 
computable. 

Lemma 11. Let L and B be respectively a CFL and an elementary bounded 
language over S such that n{LnB) — LI{L). There is an effectively computable 
elementary bounded language B' such that LI{L*^ n B') = LI{L^) for all f G N. 

Proof. By Parikh's theorem, we know that ns{L) is a computable semilinear 
set. Let us consider ui, . . . ,Ui € L such that nsiui) = Ci for i G {1, ...,£}. 

Let B' = ul ■ ■ ■ u^B^ , we see that B' is an elementary bounded language. Let 
t > be a natural integer. We have to prove that n{L*') C i7(L* n B'). 
t < {. We conclude from the preservation of LI and the hypothesis LI{L) = 
n{L n B) that 

7T(L*) = i7((LnB)*) 

C i7(L* n S*) monotonicity of LI 

C 77(L* n B'^) C B'^ since ee B 

C i7(L* n B') def. of B' 

t > £ Let us consider w G L*. For every i G {!,...,£} and j G {1, . . . , fc.;}, there 
exist some positive integers Xij and /i^, with X]i=i P'i — t such that 

e e ki 

n{w) = ^fj.,c, + ^^x,jPij . 

i—l i—1 j — 1 

We define a new variable for each i G { 1 , . . . , ^} : a; = < ' 

I otherwise. 

For each j G {1, . . . , we also consider Zi a word of L U {e} such that Zi = e if 

/Ui = and LL{zi) =Ci + J2f=i ^ijPij '^Ise. 

Let w' = u"^^ ... u'^'zi ...Zi. Clearly, 77(w') = 77(w) and w' u\ ■ ■ ■ u\(L \J 
{e})^. For each i G {1,...,^}, i7(L n B) = n{L) shows that there is z[ G 
(L n S) U {e} such that n{z[) = n{zf). Let w" = u"^ . . . u"' z[ ...z\. We find 
that LL{w") — LL{w), w" G B' and we can easily verify that w" G L*. □ 



Regular Languages. The construction of an elementary bounded language that 
solves Pb. 1 for a regular language L is known from [ li] (see also [17], Lem. 4.1). 
The construction is carried out by induction on the structure of a regular ex- 
pression for L. Assuming i ^ 0, the base case (i.e. a symbol or e) is trivially 
solved. Note that if L = then every elementary bounded language B is such 
that niLDB) = n{L) = 0. 

The inductive case falls naturally into three parts. Let Ri and R2 be regu- 
lar languages, and Bi and B2 the inductively constructed elementary bounded 
languages such that 7T(i?i n Bi) = 7T(i?i) and 77(i?2 n B2) = 77(i?2). 

concatenation For the instance Ri ■ R2, the elementary bounded language 
Bi ■ B2 is such that n{{Ri ■ R2) n {Bi ■ B2)) = i7(i?i • R2Y 

union For i?i U i?2, the elementary bounded language Bi ■ B2 suffices; 

Kleene star Let us consider i?i and Lem. 11 shows how to effectively 
compute an elementary bounded language B' such that for every t S N, 
n{R\r\B') = U(R\). Let us prove that B' solves Pb. 1 for the instance R\. 
In fact, if w is a word of R\^ there exists a t e N such that w G R{. Then, 
we can find a word w' in R{ D B' with the same Parikh image as w. This 
proves that 11 (RI) C n{Rl n B'). The other inclusion holds trivially. 

Proposition 2. For every regular language R, there is an effective procedure to 
compute an elementary bounded language B such that n{Rr\ B) = n{R). 

Linear Languages. We now extend the previous construction to the case of 
linear languages. Recall that linear languages are used to represent the iterates 
(i/fc)fegN- Lemma 12 gives a characterization of linear languages based on regular 
languages, homomorphism, and some additional structures. 

Lemma 12. (from [ ]) For every linear language L over S, there exist an 
alphabet A and its distinct copy A, an homomorphism h : [AU A)* — )• S* and a 
regular language R over A such that L = h{RA* f] S) where S — {ww^ \ w £ A*} 
and w'^ denotes the reverse image of the word w. Moreover there is an effective 
procedure to construct h, A, and R. 

Proof. Assume the linear language L is given by linear grammar G = {X, S, 6) 
and a initial variable Xq. We define the alphabet A to be {op \ p £ S}. We 
define the regular language R as the language accepted by the automaton 
given by {X U {g/}, T, Xq, {g/}) where: T = {{X,ap,Y) \ p = (X, aY/S) e 6} U 
{{X,ap,qf) I p = {X,a) € (5 A a G U*}. Next we define the homomorphism, h 
which, for each p = {X, aYl3) e 6, maps Op and to a and f3, respectively. By 
construction and induction on the length of a derivation, it is easily seen that 
the result holds. □ 

Next, we have a technical lemma which relates homomorphism and the Parikh 
image operator. 



Lemma 13. Let X,Y C S* be two languages and a homomorphism h : A* 
S* , we have: 

n{x) = n{Y) implies n{h{x)) = n{h{Y)) . 



Proof. It suffices to show that the result holds for — replaced by C. Let x' G 
h{X). We know that there exists x £ X such that x' — h[x). The equality 
n{X) — n{Y) shows that there exists y gY such that n{y) ~ n{x). It is clear 
by property of homomorphism that n{h{y)) ~ n{h{x)). □ 

The next result shows that an elementary bounded language that solves Pb. I 
can be effectively constructed for every linear language L that is given by h and 
R such that L = h{RA* n S). 

Proposition 3. For every linear language L — h{RA* H S) where h and R are 
given, there is an effective procedure which solves Pb. 1 for the instance L, that 
is a procedure returning an elementary bounded B such that 7T(Ln B) = n{L). 

Proof. Since i? is a regular language, we can use the result of Prop. 2 to effectively 
compute the set {wi, . . . , Wm} of words such that for R' = Rf) wl ■ ■ ■ we 
have n{R') = n{R). Also, we observe that for every language Z C A* we have 
ZA* ns ^ {ww"- \ weZ}. 

n{R') = n{R) by above 

only if n{R'A* n S) ^ n{RA* n S) by above 

only if n{h{R'A* n S}) = n{h{RA* n S)) Lem. 13 

only if n{h{R'A* f] S)) = n{L) def. of L 

only if n{h{RA* n S") n • • • wl.wC ■ ■ ■ w{) = n{L) def. of R' 
only if n{h{RA* r\S)r\ h{wl ■ ■ ■ w*^^* ■ ■ ■ ?^*)) 77(L) 

only if n{L n h{wl ■ ■ ■ wl,wC ■ ■ ■ uA)) = n{L) def. of L 
only if n{L n h{wi)* ■ ■ ■ h{w^)*h{^)* ■ ■ ■ h{w[)*) = n{L) 

which concludes the proof since h{w) E S* if w E {AU A)* . □ 

Linear languages with Substitutions. Our goal is to solve Pb. 1 for fc-fold 
compositions, i.e. for languages of the form ct|(w^). Prop. 3 gives an effective 
procedure for the case j — k since cr^(ux) is a linear language. Prop. 4 generalizes 
to the case j < k: given a solution to Pb. 1 for the instance cr|_|_]^(w^), there is 
an effective procedure for Pb. 1 for the instance aj o ajj^i{vx) — (^x)- 

Proposition 4. Let 



1. L be a CFL over S; 



2. B an elementary bounded language such that 11 {L H B) ~ n{L); 

3. a and r he two substitutions over S such that for each a Cz S, (i) (y{a) and 
T{a) are respectively a CFL and an e.b. and (ii) n{(j{a) H T(a)) = n{(j{a)). 

Then, there is an effective procedure that solves Pb. 1 for the instance o'{L), by 
returning an elementary bounded language B' such that n{a{L)C]B') — n[cr{L)). 



Proof. Let wi, . . . ^w^ G S* be the words such that B — w\ - ■ ■w*j^. Let Li = 
a{wi) for each i G {!,..., k}. Since a{a) is a CFL so is a{wi) by property of 
the substitutions and the closure of CFLs by finite concatenations. For the same 
reason, T{wi) is an elementary bounded language. Next, Lem. If where the 
elementary bounded language is given by T{wi), shows that we can construct an 
elementary bounded language Bi such that for all t G N, n{Ll n Bi) = n{L\). 
Define B' — Bi . . . Bk that is an elementary bounded language. We have to prove 
the inclusion n{a{L)) C ]J{cr{L)r\B') since the reverse one trivially holds. So, let 
w e ct{L). Since i7(L Dwl - ■ ■ w^) = n{L), there is a word w' G a{L Hwl- ■ - wl) 
such that n{w) = n{w'). Then we have 

w' G a{L n wl ■ --wl) 

G cr(w*^ . . . w*f^ ) for some ti, . . . ,tk 

G cr{w\^) . . . a{w^f!') property of subst. 

G tT(wi)'^ . . . cr{wkY'' property of subst. 

eL{^...Ll^ a{wi)^U 

For each i G {f , . . . , k}, we have n{L\^ n Bi) = n{LY), so we can find w" G 
{L\' n Bi) . . . (L^" n Bk) such that 77 (w") = n{w'). Definition of B' also shows 
that w" G B'. Moreover 

w" G (L*i n Bi) . . . {Ll^ n Bk) 



€ a{wiY' ...aiwk)*" a{wi) ^ L, 

G a{w*'i) . . . a{w*k) property of subst. 

G cr{w{^ . . . wl'') property of subst. 

G a{L nwl-.. w*k) wl^ ...wl'' e Lnwl-.. w*k 
ea{L) 

Finally, w" G B' and w" G a-{L) and n{w") — n{w'), which in turn equals 

n{w), prove the inclusion. □ 

We use the above result inductively to solve Pb. f for fc-fold composition as 
follows: fix L to be cr^+i(w^), B to be the solution of Pb. f for the instance L, a 
to be a J and r a substitution which maps every v\ to the solution of Pb. f for 
the instance Oj{v^-^. Then B' is the solution of Pb. f for the instance a^{v\). 



Algorithm 1: Bounded Sequence 



Data: G a linear grammar 

Data: B a valuation s.t. for every X £ X B{X) is an elementary bounded 

language and n{Lx{G)) = n{Lx{G) n B{X)) 
Data: n £ N 

Result: B G C'^ such that for every X € X B{X) is an elementary bounded 
and n{B{X) n i/„(X)) = n{u^{X)) 

1 Let B„_i be -B[u^"^]; 

for i = n — 2,n — 3, ...,0 do 

Let Ti+i be the substitution which maps each ii^'^ on -§[11^] and leaves each 
letter of E unchanged; 
foreach X £ X do 

2 Let Bi(X) be the language returned by Prop. 4 on the languages 
'^2+2{''^3() a-nd Bi+\(X), and the substitutions Gi+\,Ti+\\ 

Let To be the substitution which maps each on the elementary bounded 
language wl ■ ■ ■ Wp where {wi, . . . ,Wp} = cro(wx) and leaves each letter of S 
unchanged; 
foreach X £ X do 

3 Let B{X) be the language returned by Prop. 4 on the languages a'i{vx) 
and Bo(X), and the substitutions ag, tq; 

return B 



4.1 fc-fold Substitutions 

Let us now solve Pb. 1 where the instance is given by a /c-fold composition. 
Given a CFL L — Lxg(G) where G = {X, S,6) is a grammar and Xq £ X an 
initial variable, we compute the linear grammar G and the fc-fold composition 
^'^i}o<j<n ^ defined in Sec. 3.3. With the result of Prop. 3, we find a valuation 
B such that for every variable X, (1) B{X) is an elementary bounded language 
and (2) n{Lx{G)) = n{Lx{G) n B{X)). 

The above reasoning is formally explained in Alg. 1. 

We now prove the following invariants for Alg. 1. 

Lemma 14. In Alg. 1, for every X £ X , 

— for every k £ {0, . . . , n — 1}, B]^{X) is an elementary bounded language on 
{S U v%r such that n{al^,{v\) n Bk{X)) = n{a^^,{v^)); 

— B{X) is an elementary bounded language on S* such that n{i>n{X) n 

B{x)) = n{ujx)). 

Proof. — By induction on k: 

Base case, [k — n — 1) Alg. 1 assumes that B{X) is an elemen- 
tary bounded language, so is i?„_i by line I. It remains to prove that 
77(cr„(w^)ni3„_i(A)) = i7((T„(?;J)), which is equivalent, by definition of (t„ 
and i?„_i, to i7(Lx(G)[i>r'] n B[v'^-']{X)) = i7(Lx(G)[i'r '])• By prop- 
erty of the symbol-to-symbol substitution "■[^^/t,"-!] i the equality reduces to 

n{Lx{G) n ]3{X)) = n{Lx{G)) which holds by assumption of Alg. 1. 



Inductive case. (0 < k < n — 2) At line 1, we see that we can ap- 
ply the result of Prop. 4 because (1) cril^2i'^x) ^ (CFLs are closed 
by context-free substitutions), (2) _Bj_|_i(X) is an elementary bounded lan- 
guage (induction hypothesis), (3) for every variable Y € X, 0-^+1(1;^^) is 
a CFL, Ti+i{v^^) is an elementary bounded language and n{ai+i{vp'^) D 
Ti+i{vp'^)) = II{ai+i{vp'^)). Hence, the proposition shows that Bi{X) is an 
elementary bounded language and n{a^^i{v\) n Bi[X)) — U {<7'2j^i{v^)) . 
— The above invariant for fc = shows that, for every variable X G X , (1) 
Ba{X) is an elementary bounded language, and (2) 7T(cr"(u^) n Bo{X)) = 
n{a1{v'^)). We conclude from line 1 and Prop. 4 that i7(crj(w^) n S(X)) = 
nlcf^l'v'k)), and that i7(iv„(X) n B{X)) = n[vn{X)) by Lem. 8. 

□ 

Referring to our initial problem, we finally find that: 

Corollary 3. Let B he the valuation returned by Alg. 1, B is a valuation in 
such that for every X G X : n{LxiG) D B{X)) ^ n{Lx{G)). 

In fact, for X — Xq, B{Xo) is the solution of Pb. 1 for the instance L. This 
concludes the proof of Th. 1. In what follows, we show two applications of Th. 1 
in software verification. 

Iterative Algorithm. We conclude this section by showing a result related to 
the notion of progress if the result of Th. 1 is applied repeatedly. 

Lemma 15. Given a CFL L, define two sequences {Li)i^^, {Bi)ii^^ such that 
(1) Lq — L, (2) Bi is elementary bounded and 11 {Li D Bi) — LI{Li), (3) ii+i = 
Lif] Bi. For every w £ L, there exists i € N such that w ^ Li. Moreover, given 
Lq, there is an effective procedure to compute Li for every i > 0. 

Proof. Let w £ L and let v = LI{w) be its Parikh image. We conclude form 
n{LQr\BQ) = LI{Lq) that there exists a word w' S Bq such that LI{w') — v. Two 
cases arise: either w' = w and we are done; or w' ^ w. In that case Li = LqHBq 
shows that w' ^ Li. Intuitively, at least one word with the same Parikh image 
as w has been selected by Bq and then removed from Lq by definition of Li. 
Repeatedly applying the above reasoning shows that at each iteration there exists 
a word w" such that LI{w") = v, w" G Bi and w" ^ L^+i since L.^+i = LiCi Bi. 
Because there are only finitely many words with Parikh image v we conclude that 
there exists j G N, such that w ^ Lj. The effectiveness result follows from the 
following arguments: (1) as we have shown above (our solution to Pb. 1), given 
a CFL L there is an effective procedure that computes an elementary bounded 
language B such that n{L O B) = LI{L)\ (2) the complement of i? is a regular 
language effectively computable; and (3) the intersection of a CFL with a regular 
language is again a CFL that can be effectively constructed (see [I-)]). □ 

Intuitively this result shows that given a context-free language L, if we repeatedly 
compute and remove a Parikh-equivalent bounded subset of L {LC\B is effectively 
computable since _B is a regular language), then each word ui of L is eventually 
removed from it. 



5 Applications 



We now demonstrate two applications of our construction. The first application 
gives a semi-algorithm for checking reachability of multithreaded procedural pro- 
grams [19,14,4]. The second application computes an under approximation of the 
reachable states of a recursive counter machine. 

5.1 Multithreaded Procedural Programs 

Multithreaded Reachability. A common programming model consists of mul- 
tiple recursive threads communicating via shared memory. Formally, we model 
such systems as pushdown networks [20]. Let rt be a positive integer, a pushdown 
network is a triple Af = iG,r, (zij)i<j<„) where G is a finite non-empty set of 
globals, F is the stack alphabet, and for each 1 < i < n, Z\i is a finite set of 
transition rules of the form (5,7) ^ {9' tOl) for g,g' €zG,"f€zr,a£r*. 

A local configuration of A/" is a pair (17, a) Cz G x F* and a global configuration 
of A/" is a tuple {g,ai, . . . where g G G and ai, . . . , a„ £ I^* are individual 

stack content for each thread. Intuitively, the system consists of n threads, each 
of which have its own stack, and the threads can communicate by reading and 
manipulating the global storage represented by g. 

We define the local transition relation of the i-th thread, written -^i, as 
follows: (g,7/3) -J>i {g',af3) iff (5,7) ^ {g',a) in Ai and 13 G F* . The transi- 
tion relation of Af, denoted — ?>, is defined as follows: (5, ai, . . . , a^, . . . , a„) — ^ 
((?', ai, . . . , a^, . . . , a„) iff {g, ai) ->i (g', a^). By — >*, — >*, we denote the reflexive 
and transitive closure of these relations. Moreover, we define the global reachabil- 
ity relation ^ as a reachability relation where all the moves are made by a single 
thread: {g,ai, . . . , a^, . . . , a„) ^ {g',ai, . . . , a-, . . . , a„) iff ig,ai) -)■* {g' ,a[) for 
some 1 < i < n. The relation holds between global configurations reachable 
from each other in a single context. Furthermore we denote by where j > 0, 
the reachability relation within j contexts: is the identity relation on global 
configurations, and -^i_|_i= ^i o Let Co and C be two global configura- 
tions, the reachability problem asks whether Cq — )■* C holds. An instance of the 
reachability problem is denoted by a triple (A/", Cq, C). 

A pushdown system is a pushdown network where n = 1, namely (G, F, A). A 
pushdown acceptor is a pushdown system extended with an initial configuration 

Co e G X _r*, labeled transition rules of the form (5,7) ^ {g'ct) for g,g',J,ci 
defined as above and A € S U {e}. A pushdown acceptor is given by a tuple 
{G, F, A, Co). The language of a pushdown acceptor is defined as expected 
where the acceptance condition is given by the empty stack. 

In what follows, we reduce the reachability problem for a pushdown network 
of n threads to a language problem for n pushdown acceptors. The pushdown 
acceptors obtained by reduction from the pushdown network settings have a 
special global _L that intuitively models an inactive state. The reduction also 
turns the globals into input symbols which label transitions. The firing of a 
transition labeled with a global models a context switch. When such transition 



fires, every pushdown acceptor synchronizes on the label. The effect of such a 
synchronization is that exactly one acceptor will change its state from inactive 
to active by updating the value of its global (i.e. from _L to some g G G) and 
exactly one acceptor will change from active to inactive by updating its global 
from some g to _L. All the others acceptors will synchronize and stay inactive. 

Given an instance of the reachability problem, that is a pushdown network 
{G, r, {Ai)i<i<n) with n threads, two global configurations Co and G (assume 
wlog that G is of the form {g,e, . . . , e)), we define a family of pushdown acceptors 
{(G',r,i:,Z\^,cj,)}^<,^<„, where: 

— G' = G U {-L}, r is given as above, and S = G x {!,..., n}, 

— is the smallest set such that: 

• {g, 7) ^ {g', a) in if {g, 7> ^ (.9', a) in A; 

• {g, 7) (-L, 7) for j e {1, . . . , n} \ {i}, g e G, 7 e T; 
. (±,7) (±,7) forje{l,...,n}\«, geG, 7er; 

• (_L, 7) (g, 7) for geG,"f(zr. 

— let Go = (5,"!, • ■ ■ ,ai, . . .,a„), is given by (-L,ai) if i > 1; (5, ai) else. 

Proposition 5. Let n be a positive integer, and (A/", Go,G) be an instance 
of the reachability problem with n threads, one can effectively construct CFLs 
(Li, . . . , L„) (as pushdown acceptors) such that Gq — >■* G iff LiC\ ■ ■ ■ C\ ^ 

The converse of the proposition is also true, and since the emptiness problem 
for intersection of CFLs is undecidable [13], so is the reachability problem. We 
will now compare two underapproximation techniques. The context-bounded 
switches for the reachability problem [ ' and the bounded languages for the 
emptiness problem that is given below. 

Let Li, . . . , Lfc be context-free languages, and consider the problem to decide 
ifn i<i<k 7^ ^- We give a decidable sufficient condition: given an elementary 
bounded language _B, we define the intersection modulo B of the languages 

as Li = (n, Li)r\B. Clearly, fli^^ U^^b implies Hi Li ^ 0. Below we show 
that the problem Hi^'' 7^ is decidable . 

Lemma 16. Given an elementary bounded language B — w\ - ■ ■ and CFLs 
Li, . . . , Lk, it is decidable to check if ni<j<A: Li 7^ 0. 

Proof. Define the alphabet A — {ai, . . . , a„} disjoint from S. Let h be the ho- 
momorphism that maps the symbols ai, . . . , a„ to the words wi, . . . , Wn, respec- 
tively. We show that ni<»<fc {h'HL, n S) n • • • a^) ^ iff nl<l<fc L, ^ 0. 

( s ) 

We conclude from w G ni<i<fc Li that w £ B and w £ Li for every 1 < i < A:, 
hence there exist ti, . . . , t„ S N such that w = . . . wl^ by definition of B. 
Then, we find that (ii, . . . , i„) = LI A{h'^^ {w)r\a\ ■ ■ ■ a* ), hence that (ii, . . . , i„) G 
LlA{h~^{Li n -B) n • • • a* ) for every 1 < i < A: by above and finally that 
^l<^<kLIA{h-\L,C^B)C^al■■■al). 



Algorithm 2: Intersection 



Input: Ul Ul : CFLs 

repeat forever 

if 77(Li) nn(i2) = then 
I return L? n L2 is empty 
else 

Compute Bi and B2 elementary bounded languages such that 
J7(Li n Si) = 77(Li) and 7I(L2 n B2) = 77(L2); 
Compute B — Bi ■ B2; 
if Li n*-^' L2 7^ then 
|_ return n L2 is not empty 

Li Li n B, L2 ^ L2 n B 



For the other implication, consider a vector of 

ni<i<fc {h~^{Li n i?) n • • • a* ) and let w = . . w*^ . For every l<i<k, 
we will show that w G Lir\B. As (ii, . . . ,t„) e i7A(/i"i(LinB)nai •••<), there 
exists a word lu' G • • • a* such that IlAiw') = (ii, . . . , i„) and h{w') G LiPiB. 
We conclude from nA{w') — {ti, . . . , t„), that w' = a* V . . a*j" and finally that, 
h{'w') = w belongs to Li n B. 

The class of CFLs is effectively closed under inverse homomorphism and in- 
tersection with a regular language [' ']. Moreover, given a CFL, we can compute 
its Parikh image which is a semilinear set. Finally, we can compute the semi- 
linear sets IlA{h~^{Li O B) Dal ■ ■ ■ a* ) and the emptiness of the intersection of 
semilinear sets is decidable [ ]. □ 

While Lem. 16 shows decidability for every elementary bounded language, in 
practice, we want to select B "as large as possible". We select B using Th. 1. 
We first compute for each language Li the elementary bounded language Bi = 
Wi • • ■ WnV such that i7(L, n B,) = n{L,). Finally, we choose B = Bi ■ ■ ■ Bk- 

By repeatedly selecting and removing a bounded language B from each Lj 
where 1 < i < fc we obtain a sequence {-^^}j>o of languages such that Li = 
L° D D . . . . The result of Lem. 15 shows that for each word w G Li, there is 
some j such that w ^ L^, hence that the above sequence is strictly decreasing, 
that is Li ~ L^ ^ Lj ^ . . . , and finally that if ni<i<fe Li ^% then the iteration 
is guaranteed to terminate. 

At Alg. 2, we present a pseudocode for the special case of the intersection of 
two CFLs. 

Comparison with Context-Bounded Reachability. A well-studied under- 
approximation for multithreaded reachability is given by context-bounded reach- 
ability [IS]. Given a pushdown network, global configurations Co and C, and a 
number fc > 1, the context-bounded reachability problem asks whether Co C 
holds, i.e. if C can be reached from Co in k context switches. This problem 
is decidable [18]. Context-bounded reachability has been successfully used in 



practice for bug finding. We show that underapproximations using bounded lan- 
guages (Lem. 16) subsumes the technique of context-bounded reachability in the 
following sense. 

Proposition 6. Let M he a pushdown network, Cq,C global configurations of 
Af, and (Li,...,L„) CFLs over alphabet S such that Cq — >* C iff Hi Li ^ 0. 
For each k > 1, there is an elementary bounded language Bk such that Co C 
only i/nP'^ ^ 0. Also, flP'^ Li^% only if Cq C. 

Proof. Consider all sequences Cq ^ Ci • • • Cfc_i Ck of k or fewer switches. 
By the CFL encoding (Prop. 5) each of these sequences corresponds to a word 
in S''. If Co C, then there is a word w Gf^^Li and w G S''. Define Bk to be 
wl ■ ■ ■ where Wi,. . . , is an enumeration of all strings in . We conclude 
from w e and the definition of B^ that w € B^, hence that Cd^''^ Li ^ 
since w G Pli^i- Fo^' the other direction we conclude from H!^'"'' 7^ ^ that 
flj L, ^ 0, hence that Cq C. □ 

However, underapproximation using bounded languages can be more pow- 
erful than context-bounded reachability in the following sense. There is a fam- 
ily {(A/fc, Cofe, Cfe)}j,gpj of pushdown network reachability problems such that 
Cofc Ck but Cofc T^fc-^i Cfc for each k, but there is a single elementary 
bounded B such that f]\^^ L^. ^ for each k, where again (^Li^, • ■ • ? -^nfc) 
CFLs such that Cofc ^ Ck iff niL^k ^ (as in Prop. 5). 

For clarity, we describe the family of pushdown networks as a family of two- 
threaded programs whose code is shown in Fig. 1. The programs in the family 
differs from each other by the value to which k is instantiated: k = 0, 1, . . . . Each 
program has two threads. Thread one maintains a local counter c starting at 0. 
Before each increment to c, thread one sets a global bit. Thread two resets bit. 
The target configuration Ck is given by the exit point of pi. We conclude from 
the program code that hitting the exit point of pi requires c > k to hold. For 
every instance, Ck is reachable, but it requires at least k context switches. Thus, 
there is no fixed context bound that is sufficient to check reachability for every 
instance in the family. In contrast, the elementary bounded language given by 
((bit == true, 2) • (bit == false, 1)) is sufficient to show reachability of the 
target for every instance in the family. 



thread pl() { thread p2() { 

int c=0; LI: bit = false; 

L:bit=true; goto LI; 

if bit == false { ++c; } > 
if c<k { goto L; } 

> 



Fig. 1: The family of pushdown network with global bit. 



5.2 Recursive Counter Machines 



In verification, counting is a powerful abstraction mechanism. Often, counting 
abstractions are used to show decidability of the verification problem. Counting 
abstractions have been applied on a wide range of applications from parametrized 
systems specified as concurrent JAVA programs to cache coherence protocols 
(see [21]) and to programs manipulating complex data structures like lists (see 
for instance [■>]). In those works, counting not only implies decidability, it also 
yields precise abstractions of the underlying verification problem. However, in 
those works recursion (or equivalently the call stack) is not part of the model. 
One option is to abstract the stack using additional counters, hence abstracting 
away the stack discipline. Because counting abstractions for the stack yields too 
much imprecision, we prefer to use a precise model of the call stack and perform 
an underapproximating analysis. This is what is defined below for a model of 
recursive programs that manipulate counters. 

Counter Machine: Syntax and Semantics. An n-dimensional counter ma- 
chine M = (Q, T, a, /3, {Gtljg J,) consists of the finite non-empty sets Q and T of 
locations and transitions, respectively; two mappings a: T i-^ Q and /? : T ^-^ Q, 
and a family {Gtjjgy of semilinear (or Preshurger definable) sets over N^". 

A M -configuration {q, x) consists of a location q € Q and a vector x G N"; we 
define Cm as the set of M- configurations. For each transition t G T, its semantics 
is given by the reachability relation RM{t) over Cm defined as {q, x)RM{t){q' , x') 
iff q = a{t), q' = (3{t), and {x,x') G Gt- The reachability relation is naturally 
extended to words of T* by defining Rm{£) = {((<Z, 2;), (q, x)) | {q,x) € Cm} 
and Rm{u ■ v) — RmIu) ° Rm[v)- Also, it extends to languages as expected. 
Finally, we write (A/, D) for a counter machine M with an initial set D C Cm 
of configurations. Note that semilinear sets carry over subsets of Cm using a 
bijection from Q to {1, ... , |Q|}. 

Computing the Reachable Configurations. Let R C Cm x Cm 

and D C Cm, we define the set of configurations post[i?](Z)) as 
{(g,x) I 3((7o,a;o) G I? A {qQ,XQ)R{q,x)}. Given a n-dim counter machine M = 
{Q, T, a, f3, {Gtjjg^), a semilinear set D of configurations and a CFL L CT* (en- 
coding execution paths), we want to underapproximate post[_Rjv/(-^)](-D): the set 
of Af-configurations reachable from D along words of L. Our underapproxima- 
tion computes the set post[RM{L')]{D) where L' is a Parikh-equivalent bounded 
subset L such that L' = L n B where B = wl ■ ■ ■ w:^. 

We will construct, given {AI,D), L and B (we showed above how to effec- 
tively compute such a i?), a pair (M', D') such that the set of M-configurations 
reachable from D along words oi L H B can be constructed from the set of M'- 
configurations reachable from D'. Without loss of generality, we assume M is 
such that Q is a singleton. (One can encode locations using counters.) 

Let M = {Q,T,a, {Ctj^g^) a 7-dim counter machine with Q = {(//} and 
B = wl ■ ■ ■ ui* such that 7T(L D B) = n{L). Let h be the homomorphism that 
maps some fresh symbols ai, . . . . a„ to the words wi, . . . , ti;„, respectively. We 
compute the language = h^^{L n i?) n ■ ■ ■ a* . Let S = n^ai,...,a„}{L'j^), 
and note that S" is a semilinear set. For clarity, we first consider a linear set H 



-y' = -y + (k + l)n 

Q' = {1^}o<^<k U {<1^3}o<iik ^ ilf) 

T'^{to}U{U,tt}^^^^,u{U„ttAl-<i: 
a' and /?' are given by the automaton 
Let i G {0, . . . ,k} and j G {1, . . . ,n} 
G+ o ...oG+ if i = 
{(x,x)eN^^'} else 
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Gt|^. = G(«;fO ° G"^ , and 
Gt,j = (a;,!-)) I «i.„+j =0} 

Let # G {+,-}, G*^. = {{{x,v),(x,v')) G N^^ j v' = t;#e„„+,}. 

Let «; G T*, G(™) is s.t. G(e) = {(a;,a;) G N^t'}, G(t) = { ((x, u), (x', ■«)) G N^^' | 
{x,x') G Gt}, and G{wp ■ Ws) = G{wp) o G{'Ws) ii w = e, t and TOs • Wp, respectively. 



Fig. 2: The 7'-dim counter machine M' = (Q', T', a', /?', {GJ^gj,,) 



where po = (Poi, ■ • ■ ,Pon) denotes the constant and {p^ = (p^, ■ • • ,Pin)}i(=i\{o} 
the set of periods of H and / = {0, . . . ,k}. Let J = {1, .... n}. In the following, 
for every pair of vectors x = {xi, . . . , Xr) and y = (j/i, . . . , y^), we denote by 
{x, y) the vector (xi, . . . , x^, j/i, . . . , t/s)- The machine M' is defined in Fig. 2. 

Between go and qoij non-deterministically picks values for all the ad- 
ditional counters which we denote ^^j. When M' fires t^^ we have 
for all i G / and G J: = X^ji and Aq^ = 1. Below, for ev- 
ery i Cz I, we denote by A^ the common value of the counters {Xij}^^j. 
Then, M' simulates the behavior of M for the sequence of transitions 
given by u;Poi+^ipii+ -+^'=P" . _^Po,^+\lPl,^+■■■+\kPk„ the Parikh image of which 
is Po + Tlii^i ^iPi- L'^t US define the set D' of configurations of Cm' as 
{{qo,{x,v)) I (g/,x)ei?Ai; = 0('=+i)"}. 

A sufficient condition for the set of reachable configurations of M' start- 
ing from D' to be effectively computable is that for each t in {^f}ig/\{o} ^ 

J'ie/ jsJ loops in Fig. 2), it holds that t* is computable and 

Presburger definable. Given t the problem of deciding if t* is Presburger de- 
finable is undecidable [1]. However, there exist some subclasses C of Pres- 
burger definable sets such that if t G C then t* is Presburger defin- 
able and effectively computable, hence the set of reachable configurations of 
{M',D') can be computed by quantifier elimination in Presburger arithmetic. 
A known subclass is that of guarded command Presburger relations. An n- 
dimensional guarded command is given by the closure under composition of 
{(a;, x') G N^" I x' = a:; + (increment), {(a;, x') G N^" | = a; - e^} (decre- 
ment) and {(a;, a;) G N^" | x = (xi, . . . , a;„) A a;^ = 0} (0-test) for 1 < i < n. 

Other subclasses are given in [•''), iU]. Note that if for each t G T of A/, Gt is 
given by a guarded command then so is each Gf for t' G T' of M' by definition. 



Hence, we find that the set post[RM'{T'*)]{D') of reachable configura- 
tions of {M',D') is Presburger definable, effectively computable and relates to 
post[i?M(-^')](^) fo'' the bounded language L' as follows. 

Lemma 17. Let {qf,x) e Cm, 



{qf,x) e post[RM{L')]{D) tff3v e nC^+i)": ((Z/,(a;,«)) G post[i?Af'(T'*)](i5')- 



We can easily compute the intersection of the two semilinear sets S and {q/} x N'*' 
over Q' x N^, because of the way we have carried the notion of semilinear set 
over Q' x N"*". We take a bijection from Q' to {1, . . . , \Q\}, so a configuration 



Hence, the intersection consists of all the vectors of S with the composant of qf 
equal to one and the others equal to zero. Lem. 15 shows that by iterating the 
construction we obtain a semi-algorithm for a context-free language. 
Acknowledgment. We thank Ahmed Bouajjani for pointing that the bounded 
languages approach subsumes the context-bounded switches one. 
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